From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 30 Nov 2022 17:45:19 +0000 (+0100)
Subject: 5.15-stable patches
X-Git-Tag: v5.10.157~16
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1bdcf3c43e3b20afd598bfa552e31e12c25cc81f;p=thirdparty%2Fkernel%2Fstable-queue.git

5.15-stable patches

added patches:
	drm-i915-fix-tlb-invalidation-for-gen12-video-and-compute-engines.patch
---

diff --git a/queue-5.15/drm-i915-fix-tlb-invalidation-for-gen12-video-and-compute-engines.patch b/queue-5.15/drm-i915-fix-tlb-invalidation-for-gen12-video-and-compute-engines.patch
new file mode 100644
index 00000000000..ccf85466dd1
--- /dev/null
+++ b/queue-5.15/drm-i915-fix-tlb-invalidation-for-gen12-video-and-compute-engines.patch
@@ -0,0 +1,39 @@
+From 04aa64375f48a5d430b5550d9271f8428883e550 Mon Sep 17 00:00:00 2001
+From: Andrzej Hajda <andrzej.hajda@intel.com>
+Date: Mon, 14 Nov 2022 11:38:24 +0100
+Subject: drm/i915: fix TLB invalidation for Gen12 video and compute engines
+
+From: Andrzej Hajda <andrzej.hajda@intel.com>
+
+commit 04aa64375f48a5d430b5550d9271f8428883e550 upstream.
+
+In case of Gen12 video and compute engines, TLB_INV registers are masked -
+to modify one bit, corresponding bit in upper half of the register must
+be enabled, otherwise nothing happens.
+
+CVE: CVE-2022-4139
+Suggested-by: Chris Wilson <chris.p.wilson@intel.com>
+Signed-off-by: Andrzej Hajda <andrzej.hajda@intel.com>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store")
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_gt.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/i915/gt/intel_gt.c
++++ b/drivers/gpu/drm/i915/gt/intel_gt.c
+@@ -982,6 +982,11 @@ void intel_gt_invalidate_tlbs(struct int
+ 		if (!i915_mmio_reg_offset(rb.reg))
+ 			continue;
+ 
++		if (GRAPHICS_VER(i915) == 12 && (engine->class == VIDEO_DECODE_CLASS ||
++		    engine->class == VIDEO_ENHANCEMENT_CLASS ||
++		    engine->class == COMPUTE_CLASS))
++			rb.bit = _MASKED_BIT_ENABLE(rb.bit);
++
+ 		intel_uncore_write_fw(uncore, rb.reg, rb.bit);
+ 	}
+ 
diff --git a/queue-5.15/series b/queue-5.15/series
index 78084c6c93d..ed4608aad3d 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -203,3 +203,4 @@ drm-amd-dc-dce120-fix-audio-register-mapping-stop-triggering-kasan.patch
 drm-amd-display-no-display-after-resume-from-wb-cb.patch
 drm-amdgpu-enable-aldebaran-devices-to-report-cu-occupancy.patch
 drm-amdgpu-always-register-an-mmu-notifier-for-userptr.patch
+drm-i915-fix-tlb-invalidation-for-gen12-video-and-compute-engines.patch